From 96628baebe8b3cb2e8add7e05caef23d0844df99 Mon Sep 17 00:00:00 2001 From: Alexa <53471801+Alexa-RR@users.noreply.github.com> Date: Tue, 30 Jun 2026 15:47:26 +0300 Subject: [PATCH] Migrate auth to Open.IdentityServer --- Dockerfile | 8 +++---- DorkNet.Models/DorkNet.Models.csproj | 4 ++-- .../Auth/IdentityServerIntegration.cs | 16 +++++--------- .../Controllers/Admin/AdminController.cs | 8 ------- .../Controllers/Auth/AuthController.cs | 2 +- DorkNet.Server/DorkNet.Server.csproj | 21 ++++++++++--------- .../admin-ui/src/pages/IdentityServer.tsx | 4 ---- README.md | 2 +- .../DorkNet.ApiRouteCoverage.csproj | 2 +- 9 files changed, 25 insertions(+), 42 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8c50073..176bbcc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,14 +1,14 @@ # DorkNet.Server container image — Coolify deploy target. # ──────────────────────────────────────────────────────────────────── # Multi-stage: SDK image builds + publishes, runtime image is the -# slimmer aspnet:9.0 with only the published output. +# slimmer aspnet:10.0 with only the published output. # # Build context: repo root (so Tools/ and DorkNet.Models/ are visible # to ProjectReference + dotnet restore). The .dockerignore at the # repo root keeps the bin/, obj/, and other dev junk out of the # context. -ARG DOTNET_VERSION=9.0 +ARG DOTNET_VERSION=10.0 ARG NODE_VERSION=20 # ── admin SPA build stage ────────────────────────────────────────── @@ -76,13 +76,13 @@ WORKDIR /app # curl + wget for healthcheck probes — Coolify v4 defaults to wget for # its own probe regardless of what the image's HEALTHCHECK uses, so -# both have to be present. The aspnet:9.0 base image strips both by +# both have to be present. The aspnet:10.0 base image strips both by # default to keep the surface area small. RUN apt-get update \ && apt-get install -y --no-install-recommends curl wget \ && rm -rf /var/lib/apt/lists/* -# Run as a non-root user — aspnet:9.0 ships with the `app` UID 1654. +# Run as a non-root user — aspnet:10.0 ships with the `app` UID 1654. # Coolify mounts persistent volumes with write permission for this UID. USER app diff --git a/DorkNet.Models/DorkNet.Models.csproj b/DorkNet.Models/DorkNet.Models.csproj index 125f4c9..9ed914b 100644 --- a/DorkNet.Models/DorkNet.Models.csproj +++ b/DorkNet.Models/DorkNet.Models.csproj @@ -1,7 +1,7 @@ - + - net9.0 + net10.0 enable enable diff --git a/DorkNet.Server/Auth/IdentityServerIntegration.cs b/DorkNet.Server/Auth/IdentityServerIntegration.cs index 1c3a1d4..a7ec4ca 100644 --- a/DorkNet.Server/Auth/IdentityServerIntegration.cs +++ b/DorkNet.Server/Auth/IdentityServerIntegration.cs @@ -3,10 +3,10 @@ using System.Security.Claims; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; using System.Text; -using Duende.IdentityServer; -using Duende.IdentityServer.Models; -using Duende.IdentityServer.Services; -using Duende.IdentityServer.Validation; +using Open.IdentityServer; +using Open.IdentityServer.Models; +using Open.IdentityServer.Services; +using Open.IdentityServer.Validation; using Microsoft.AspNetCore.Http.Features; using Microsoft.EntityFrameworkCore; using Microsoft.Extensions.Primitives; @@ -206,12 +206,6 @@ public static class RecRoomIdentityServerRegistration .AddIdentityServer(options => { options.IssuerUri = domain.AuthIssuer.TrimEnd('/'); - options.KeyManagement.Enabled = false; - var licenseKey = - Environment.GetEnvironmentVariable("DUENDE_IDENTITYSERVER_LICENSE_KEY") - ?? config["IdentityServer:LicenseKey"]; - if (!string.IsNullOrWhiteSpace(licenseKey)) - options.LicenseKey = licenseKey; }) .AddInMemoryIdentityResources(RecRoomIdentityServerConfig.IdentityResources) .AddInMemoryApiScopes(RecRoomIdentityServerConfig.ApiScopes) @@ -256,7 +250,7 @@ internal static class RecRoomIdentityServerConfig ClientName = "Rec Room game client", RequireClientSecret = true, ClientSecrets = { new Secret(ClientSecret.Sha256()) }, - AllowedGrantTypes = { GrantType.ResourceOwnerPassword, GrantType.RefreshToken, CachedLoginGrantType }, + AllowedGrantTypes = { GrantType.ResourceOwnerPassword, "refresh_token", CachedLoginGrantType }, AllowedScopes = RecRoomScopes(), AllowOfflineAccess = true, AccessTokenLifetime = 60 * 60 * 12, diff --git a/DorkNet.Server/Controllers/Admin/AdminController.cs b/DorkNet.Server/Controllers/Admin/AdminController.cs index 58a15f8..474fc77 100644 --- a/DorkNet.Server/Controllers/Admin/AdminController.cs +++ b/DorkNet.Server/Controllers/Admin/AdminController.cs @@ -40,7 +40,6 @@ public class AdminController( SignupCodeService signupCodes, IObjectStorage storage, DomainConfig domain, - IConfiguration config, IdentityServerSigningKeyProvider signingKeys, ILogger adminLogger) : ControllerBase { @@ -1170,9 +1169,6 @@ public class AdminController( var certPath = signingKeys.CertificatePath; var fullCertPath = Path.GetFullPath(certPath); var certificateExists = signingKeys.LoadedFromBase64 || System.IO.File.Exists(fullCertPath); - var licenseConfigured = - !string.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable("DUENDE_IDENTITYSERVER_LICENSE_KEY")) - || !string.IsNullOrWhiteSpace(config["IdentityServer:LicenseKey"]); return Ok(new { @@ -1204,10 +1200,6 @@ public class AdminController( NotAfterUtc = signingKeys.Certificate.NotAfter.ToUniversalTime(), Algorithm = SecurityAlgorithms.RsaSha256, }, - License = new - { - Configured = licenseConfigured, - }, PersistedGrants = new { Store = "in-memory", diff --git a/DorkNet.Server/Controllers/Auth/AuthController.cs b/DorkNet.Server/Controllers/Auth/AuthController.cs index 78bd5b3..37853df 100644 --- a/DorkNet.Server/Controllers/Auth/AuthController.cs +++ b/DorkNet.Server/Controllers/Auth/AuthController.cs @@ -6,7 +6,7 @@ using DorkNet.Server.Services; namespace DorkNet.Server.Controllers.Auth; /// -/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by Duende IdentityServer. +/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by IdentityServer. /// [ApiController] public class AuthController( diff --git a/DorkNet.Server/DorkNet.Server.csproj b/DorkNet.Server/DorkNet.Server.csproj index f01b039..b3f2203 100644 --- a/DorkNet.Server/DorkNet.Server.csproj +++ b/DorkNet.Server/DorkNet.Server.csproj @@ -1,21 +1,22 @@ - net9.0 + net10.0 enable enable - - - - + + + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - - + + - - + + - +